1

Can anyone help with the following;

So in a program if we keep a pda seed as authority to claim from that the spl token. (Kind of global authority). Same seed is sent off frontend.

Is there a way to reverse engineer / hack programs? If someone knows the seeds, will it be considered a threat? As seeds can be founded within dev tools.

pub const GLOBAL_AUTHORITY_SEED: &str = "global-authority";

pub struct Initialize<'info>{
    #[account(mut)]
    pub admin: Signer<'info>,
    #[account(
        init,
        payer = admin,
        seeds = [GLOBAL_AUTHORITY_SEED.as_ref()],
        bump,
        space = 64,
    )]
    pub global_authority: Account<'info, GlobalPool>,
    pub system_program: Program<'info, System>,

}

this is my initialization of global_authority and I am giving authority of TokenAcount to this address like:

 #[account(
        init,
        payer = client,
        // seeds = [b"poolAta", user.key().as_ref()],
        seeds = [b"poolAta", client.key().as_ref(), pool_mint.key().as_ref(), project_name.as_bytes()],
        bump,
        token::mint = pool_mint,
        token::authority = global_authority,
    )]

Now, if anyone can have my global authority seed he can write rpc call and can transfer spl tokens using the following function:

token::transfer(
            CpiContext::new_with_signer(
                token_program.clone(),
                token::Transfer {
                    from: ctx.accounts.pool_ata.to_account_info(),
                    to: ctx.accounts.user_ata.to_account_info(),
                    authority: ctx.accounts.global_authority.to_account_info(),
                },
                signer
            ),
            1000000000
        )?;

1 Answer 1

1

It is up to a program to decide who can do what with an account. If you need a global authority, your processor needs to enforce that they've actually signed before allowing data manipulation to occur. PDAs are purely an addressing scheme, there is no implicit security in using them

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.